HDFC Bank is, by its own account, the largest credit card issuer in India: its annual report for fiscal year 2022 gives 16.5 million cards outstanding as of 31 March 2022.
On 21 November 2020, the bank's internet banking and payment system had outages due to a power failure in the primary data centre, as the bank told the New York Stock Exchange. It wasn't the first time: the regulator's order that followed concerned outages in the bank's internet banking, mobile banking and payment utilities over the past 2 years.
On 2 December 2020, the Reserve Bank of India (RBI), the country's banking regulator, issued that order, and HDFC Bank disclosed it the next day. According to the bank's disclosure, the RBI advised it to temporarily stop:
- all launches of the digital business-generating activities planned under its Digital 2.0 programme, and other proposed business-generating IT applications, and
- sourcing new credit card customers.
The order also said the bank's Board should examine the lapses and fix accountability, and, the bank later reported, the RBI appointed a third-party auditor to audit its systems. The measures would be considered for lifting once the bank satisfactorily complied with the major critical observations identified by the RBI. The bank said it expected no impact on its existing credit cards, digital banking channels and existing operations.
The bank's fixes, as listed in its 2022 annual report: it moved its core data centres in Bengaluru and Mumbai to new facilities, reinforcing its ability to switch over in less than 45 minutes; tripled its UPI capacity; doubled net banking and mobile banking capacity, to 90,000 concurrent users; and completed disaster recovery drills for all critical payment systems.
After the audit, the bank reported, the restrictions were partially lifted in August 2021, and the embargo on Digital 2.0 was fully removed in March 2022, about 15 months after the order.
- 2 years of outages covered by the RBI's order, including the 21 November 2020 power failure
- 16.5 million credit cards outstanding as of 31 March 2022, by the bank's count
- Less than 45 minutes to switch data centres after the fixes
- 90,000 concurrent users on net and mobile banking: double the old capacity
Why it matters: Every data centre loses power one day. What decides whether that becomes your outage is the failover: built, sized and drilled until switching to the backup is routine.